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DETAILED ACTION 

This action is responsive to application 10/632521 filed on 8/1/03. 
Claims 1-85 have been examined and are pending. 

Claim Rejections - 35 USC § 102 

The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 
A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by 
another filed in the United States before the invention by the applicant for patent or (2) a patent 
granted on an application for patent by another filed in the United States before the invention by the 
applicant for patent, except that an international application filed under the treaty defined in section 
351(a) shall have the effects for purposes of this subsection of an application filed in the United States 
only if the international application designated the United States and was published under Article 21(2) 
of such treaty in the English language. 

Claims 1-20, 22-26, 28-48, 50-52, 54, 58, 60, 62-64, 66, 68-79, and 81-84 are 
rejected under 35 U.S.C. 102(e) as being anticipated by Hu et al. ('Hu', hereinafter) (US 
2004/0158746 A1). 

With respect to claim 1, Hu teaches A method, comprising: 'selecting multiple 
data sources connected to an identity integration system' (page 4, paragraph 
0038) 

'performing a password operation on a password associated with at least 
one of the multiple data sources, wherein the password operation is performed 
using the identity integration system' (page 4, paragraph 0038). 
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With respect to claim 2, Hu teaches, 'determining an identity of a user, 
wherein the multiple data sources are associated with the identity' (page 4, 
paragraph 0038). 

'querying the identity integration system to find the multiple data sources 
associated with the identity' (page 4, paragraph 0038). 

With respect to claim 3, Hu teaches 'wherein the password operation 
comprises updating one or more passwords associated with the multiple data 
sources using joined objects across the multiple data sources, wherein the joined 
objects are stored in the identity integration system' (page 8, paragraph 0067). 

With respect to claim 4, Hu teaches 'the multiple passwords are updated to 
new passwords that differ from each other' (page 8, paragraph 0067). 

With respect to claim 5, Hu teaches 'each of the multiple passwords is 
updated to the same password' (page 8, paragraph 0067). 

With respect to claim 6, Hu teaches 'password operation comprises one of 
changing, setting and resetting the password' (page 8, paragraph 0067). 

With respect to claim 7, Hu teaches 'each of the multiple data sources differ 
from others of the multiple data sources with respect to at least one of a protocol, 



Application/Control Number: 10/632,521 Page 4 

Art Unit: 2167 

a platform, a format, and a data transmission medium for data storage' (page 3, 
paragraph 0032). 

With respect to claim 8, Hu teaches 'each of the multiple data sources differs 
in a connection to the identity integration system with respect to at least one of a 
protocol, a platform, a format, and a data transmission medium for data storage' 

(page 3, paragraph 0032). 

With respect to claim 9, Hu teaches 'each of the multiple data sources uses a 
different password management function' (pages 2-3, paragraph 0028). 

With respect to claim 10, Hu teaches 'the identity integration system performs 
password management for each of the multiple data sources' (pages 2-3, 
paragraph 0028). 

With respect to claim 11, Hu teaches 'some of the multiple data sources the 
identity integration system stores integrated identity information to perform 
password management' (paragraph 0040 and figure 7a). 

With respect to claim 12, Hu teaches 'the identity integration system includes 
a management agent for each of the multiple data sources to manage data 
communication between the identity integration system and each respective data 
source, and wherein for at least some of the multiple data sources a management 
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agent for the data source is configured with credentials to perform password 
management' (page 3, paragraph 0032). 

With respect to claim 13, Hu teaches Identity integration system includes a 
management agent for each of the multiple data sources to manage data 
communication between the identity integration system and each respective data 
source, and wherein for at least one of the multiple data sources a management 
agent for the data source calls for custom logic to perform password 
management for the data source' (page 3, paragraph 0033). 

With respect to claim 14, Hu teaches the management agent calls for custom 
logic from a custom logic source outside the identity integration system' (page 3, 
paragraph 0033). 

With respect to claim 15, Hu teaches 'using the identity integration system to 
produce a list of user accounts associated with the multiple data sources, 
wherein the user accounts on the list are eligible for password management' 

(paragraph 0040 and figure 7a). 

With respect to claim 16, Hu teaches 'allowing access to the identity 
integration system through a web application for password management' (page 3, 
paragraph 0029). 
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With respect to claim 17, Hu teaches 'the selecting multiple data sources and 
the performing a password operation are performed on a website generated by 
the web application' (page 3, paragraph 0029). 

With respect to claim 18, Hu teaches 'the web application accepts a password 
credential from a user to perform the password operation' (page 5, paragraph 0050 
and figure 4a). 

With respect to claim 19, Hu teaches 'asking the user questions, wherein if 
answers provided by the user are correct then the web application performs the 
password operation using the identity of a privileged user account' (page 2-3, 
paragraph 0028). 

With respect to claim 20, Hu teaches 'a list of user accounts displayable on 
the website, wherein the user accounts are associated with the multiple data 
sources' (paragraph 0040 and figure 7a). 

With respect to claim 22, Hu teaches 'communicatively coupling the identity 
integration system with the web application using an interface' (page 3, paragraph 
0029). 

With respect to claim 23, Hu teaches 'the interface is publicly available' (page 
3, paragraph 0029). 
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With respect to claim 24, Hu teaches 'interface allows a web application 
designer to customize the web application' (page 3, paragraph 0033). 

With respect to claim 25, Hu teaches 'the interface includes password 
management functions' (page 6, paragraph 0052, and figure 4b). 

With respect to claim 26, Hu teaches 'interface is capable of being changed 
for an improved version of the interface that adds more password management 
functions while using the same web application and the same identity integration 
system' (page 3, paragraph 0033). 

With respect to claim 28, Hu teaches 'the interface is secured using a security 
group' (page 2, paragraph 0027). 

With respect to claim 29, Hu teaches 'interface is secured using a security 
group that allows both searching for a connector object associated with a data 
source and setting a password for an object in the data source, wherein a 
connector object represents at least part of the data source in the identity 
integration system' (page 4, paragraph 0038) 
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With respect to claim 30, Hu teaches 'identity of a user associated with the 
multiple data sources provides a security credential for performing a password 
operation' (page 5, paragraph 0050 and figure 4a). 

With respect to claim 31, Hu teaches 'the web application produces a list of 
accounts associated with a user' (paragraphs 0040, 0071 and figures 5 and 7a). 

With respect to claim 32, Hu teaches 'the web application lists only accounts 
eligible for password management' (page 4, paragraph 0040). 

With respect to claim 33, Hu teaches 'the web application adopts a web 
application behavior based on a configuration setting' (page 3, paragraph 0033). 

With respect to claim 34, Hu teaches 'configuration setting is stored in a 
configuration file' (page 3, paragraph 0033). 

With respect to claim 35, Hu teaches 'the web application checks if one of the 
data sources is communicating before updating a password associated with the 
data source' (pages 2-3, paragraph 0028). 

With respect to claim 36, Hu teaches 'the updating comprises one of 
changing and setting the password' (page 7 paragraph 0067). 
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With respect to claim 37, Hu teaches 'the web application checks if a 
connection to one of the data sources is secure before updating a password 
associated with the data source. 

With respect to claim 38, Hu teaches 'the updating comprises one of 
changing and setting the password' (page 7 paragraph 0067). 

With respect to claim 39, Hu teaches 'displaying a status for the password 
operation' (page 6, paragraph 0052, and figure 4b). 

With respect to claim 40, Hu teaches 'displaying the status on a webpage' 
(page 6, paragraph 0052, and figure 4b). 

With respect to claim 41, Hu teaches 'auditing the password operation' (page 
3, paragraph 0035). 

With respect to claims 42 and 71, Hu teaches 'maintaining a password 
management history for the password operation' (page 0040 and figure 7a). 

With respect to claim 43, Hu teaches 'keeping the password management 
history in a connector space object, wherein the connector space object is 
included in the identity integration system' (page 0040 and figure 7a). 
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With respect to claim 44, Hu teaches 'the password management history 
includes a tracking identifier to an audit record of the password operation' (figure 
7a and paragraph 0035). 

With respect to claim 45, Hu teaches 'maintaining a repository of audit 
records for password operations performed using the identity integration system' 

(page 3, paragraph 0035 and figure 7a). 

With respect to claim 46, Hu teaches 'an audit record for a password 
operation includes at least one of an identifier of a user associated with the 
password operation, a tracking identifier to a web application initiating the 
password operation, a tracking identifier to a connector object associated with 
the password operation, a tracking identifier to a management agent associated 
with the password operation, a password operation identifier, a password 
operation status, a date, and a time' (page 4, paragraph 0040 and figure 7a). 

With respect to claim 50, Hu teaches 'custom logic performs a password 
operation on a subsequent data source not connected to the identity integration 
system' (page 3, paragraph 0050). 

With respect to claim 51, Hu teaches 'the password operation further 
comprises updating passwords in both secure and non-secure data sources 
within the multiple data sources' (page 7, paragraph 0067). 
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With respect to claim 52, Hu teaches 'the password operation further 
comprises updating passwords over both secure and non-secure connections to 
the multiple data sources' (page 2, paragraph 0027). 

With respect to claim 54, Hu teaches 'the identity integration system 
connects with diverse data sources, each data source having a different function 
for using password security' (page 3, paragraph 0032). 

With respect to claim 58, Hu teaches 'a configuration reader to obtain 
behavior settings for the web application' (page 3, paragraph 0036). 

With respect to claim 60, Hu teaches 'the account lister lists only accounts 
eligible for password management' (page 4, paragraph 0040, and figure 7a). 

With respect to claim 62, Hu teaches 'logic for checking security of a 
connection between the identity integration system and a data source' (page 2, 
paragraph 0027). 

With respect to claim 63, Hu teaches 'logic to change a password associated 
with the data source' (page 7 paragraph 0067). 
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With respect to claim 64, Hu teaches logic to set a password associated with 
the data source' (page 7 paragraph 0067). 

With respect to claim 66, Hu teaches 'password management web application 
verifies one of an identity and a credential of a user' (page 5, paragraph 0050 and 
figure 4a). 

With respect to claim 68, Hu teaches 'the web application operates in a 
security context' (page 4, paragraph 0038). 

With respect to claim 69, Hu teaches 'the security context is an application 
pool identity' (page 4, paragraph 0038). 

With respect to claim 70, Hu teaches 'a help desk application, wherein the 
web application denies a user access to the help desk application if a security 
group of the user is not approved by the web application' (pages 7-8 and 
paragraphs 66-69). 

With respect to claim 72, Hu teaches 'the identity integration system 
communicates with diverse accounts, each account having a different 
mechanism for administering a password associated with the account' (page 1, 
paragraph 0006, and page 3, paragraph 0032). 



Application/Control Number: 10/632,521 Page 13 

Art Unit: 2167 

With respect to claim 73, Hu teaches 'the identity integration system does not 
natively communicate with at least some of the diverse accounts' (page 1, 
paragraph 0006, and page 3, paragraph 0032). 

With respect to claim 74, Hu teaches A management agent for an identity 
integration system, comprising: 

logic for adapting a connection for data communication, wherein the 
connection couples an identity integration system using a first data 
communication format with a connected data source using a second data 
communication format' (page 3, paragraph 29, and figure 1). 

logic for requesting a connected data source to perform a password 
operation' (page 3, paragraph 0032). 

With respect to claim 75, Hu teaches 'the management agent performs the 
password operation' (page 3, paragraph 0032). 

With respect to claim 76, Hu teaches 'the management agent requests 
authorization for performing a password operation' (page 3, paragraph 0032). 

With respect to claim 77, Hu teaches ( the management agent is configured 
with credentials to perform a password management operation' (page 3, paragraph 
0032). 
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With respect to claim 78, Hu teaches 'the management agent is configured 
with credentials to request a password management operation' (page 3, paragraph 
0032). 

With respect to claim 79, Hu teaches logic to perform a call out for custom 
logic for performing a custom password operation' (page 3, paragraph 0032). 

With respect to claim 81, Hu teaches 'allowing input of user credentials to 
verify an identity of the user' (page 5, paragraph 0050 and figures 4a-4b). 

With respect to claim 82, this claim has essentially the same subject matter as 
set forth in claim 1 above. Therefore, claim 82 is rejected for the same reasons as 
claim 1 under Hu as set forth above. 

With respect to claim 83, Hu teaches 'multiple data sources connected to the 
identity integration system communicate in a manner different than a native 
communication of the identity integration system' (page 1 paragraph 0006 and 
page 3, paragraph 0032). 

With respect to claim 84, Hu teaches 'the identity integration system 
accomplishes a password update on each of the data sources regardless of 
whether the data sources connected to the identity integration system 
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communicate in a manner different than a native communication of the identity 
integration system' (page 7, paragraph 0067). 

Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 1 02 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

Claims 21, 47-49, 53, 55-57, 59, 61, 65, 67, 80 are rejected under 35 U.S.C. 

103(a) as being unpatentable over Hu as applied to claims 1-20, 22-26, 28-48, 50-52, 

54, 58, 60, 62-64, 66, 68-79, and 81-84 above in view of Bush etal. ('Bush' hereinafter) 

(US 2002/0083012 A1). 

With respect to claim 21, Hu fails to teach a help desk to at least assist in the 
performing a password operation. 

Bush, however, teaches a 'help desk to at least assist in the performing a 
password operation' as a password may be sent by telephone to the user (page 2, 
paragraph 0024). 

It would have been obvious to one of ordinary skill in the data processing art at 
the time of the present invention to combine the teachings of the cited references 
because the teaching of Bush would have provided Hu's system with a system to send 
a password to a user (page 2, paragraph 0024, Bush). 
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With respect to claims 47 and 59, Hu fails to teach the custom logic is executed 
after the password operation is performed. 

Bush, however, teaches 'the custom logic is executed after the password 
operation is performed' as after the user receives a password, the user enters the 
password, and access is authorized (page 2, paragraph 0024). 

It would have been obvious to one of ordinary skill in the data processing art at 
the time of the present invention to combine the teachings of the cited references 
because the teaching of Bush would have provided Hu's system with an account 
management system to authorize access to the resource (page 2, paragraph 0022, 
Bush). 

With respect to claim 48, Hu fails to teach the custom logic sends an email. 

Bush, however, teaches 'the custom logic sends an email' as the password 
may be sent through an electronic mail message (page 2, paragraph 0024). 

It would have been obvious to one of ordinary skill in the data processing art at 
the time of the present invention to combine the teachings of the cited references 
because the teaching of Bush would have provided Hu's system with sending a 
password to the user (page 2, paragraph 0024, Bush). 

With respect to claim 49, Hu fails to teach the custom logic logs password 
management activity. 
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Bush, however, teaches 'the custom logic logs password management 
activity' as a connection request is received, it is logged and then completes (page 6, 
paragraph 0036). 

It would have been obvious to one of ordinary skill in the data processing art at 
the time of the present invention to combine the teachings of the cited references 
because the teaching of Bush would have provide Hu's system with a technique that 
would combine the advantages of a logon organization (page 1, paragraph 0004, Bush) 

53. A web application for password management, comprising: 'a user identifier 
to find user identity information in an identity integration system' (page 8, 
paragraph 0074). 

'identity information query logic to search information in the identity 
integration system for accounts associated with the user' (page 8, paragraph 
0074). 

'an account lister to display the accounts associated with the user' 

(paragraph 0040, and figure 7a). 

'a password manager to request an update of a password associated with 
an account' (page 7, paragraph 0067). 

Hu fails to teach an account selector to designate at least some of the displayed 
accounts for password management and a password inputter to determine a new 
password. 
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Bush, however, teaches 'an account selector to designate at least some of 
the displayed accounts for password management' as an account selection area 
(page 2, paragraph 0024). 

'a password inputter to determine a new password' (figure 1b). 

It would have been obvious to one of ordinary skill in the data processing art at 
the time of the present invention to combine the teachings of the cited references 
because the teachings of Bush would have provided Hu's system with display pages 
provided by the account management system (page 2, paragraph 0024, bush). 

With respect to claim 55, Hu fails to teach an account status display to show 
selected accounts and a connection status of each account. 

Bush, however, teaches 'an account status display to show selected 
accounts and a connection status of each account' as an indication that the node is 
currently connected to the server computer (page 3, paragraph 0026, and figure 3). 

It would have been obvious to one of ordinary skill in the data processing art at 
the time of the present invention to combine the teachings of the cited references 
because the teaching of Bush would have provided Hu's system with an indication for 
each node currently connected (page 3, paragraph 0026, Bush). 

With respect to claim 56, Hu fails to teach a password management operation 
status for each account. 
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Bush, however, teaches 'a password management operation status for each 
account' as an indication that the node is currently connected to the server computer 
(page 3, paragraph 0026 and figure 3). 

It would have been obvious to one of ordinary skill in the data processing art at 
the time of the present invention to combine the teachings of the cited references 
because the teaching of Bush would have provided Hu's system with an indication for 
each node currently connected (page 3, paragraph 0026, Bush). 

With respect to claim 57, Hu fails to teach a status checker to verify connectivity 
and security of a connection between an account and the identity integration system. 

Bush, however, teaches 'a status checker to verify connectivity and security 
of a connection between an account and the identity integration system' (page 3, 
paragraph 0026, Bush). 

It would have been obvious to one of ordinary skill in the data processing art at 
the time of the present invention to combine the teachings of the cited references 
because the teaching of Bush would have provided Hu's system with an indication for 
each node currently connected (page 3, paragraph 0026, Bush). 

61. An interface for coupling an identity integration system with a password 
management web application, comprising: 

logic for communicating with the identity integration system, wherein the 
identity integration system is capable of updating a password on data sources 
that use various functions of password updating" (page 7 paragraph 0067). 
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'logic for communicating with the password management web application' 

(page 8 paragraph 0069). 

'logic for searching for objects in the identity integration system' (page 8, 
paragraph 0074). 

Hu fails to teach logic for checking a connection status between the identity 
integration system and a data source. 

Bush, however, teaches 'logic for checking a connection status between the 
identity integration system and a data source' (page 3, paragraph 0026 and figure 
3). 

It would have been obvious to one of ordinary skill in the data processing art at 
the time of the present invention to combine the teachings of the cited references 
because the teaching of Bush would have provided Hu's system with an indication for 
each node currently connected (page 3, paragraph 0026, Bush). 

With respect to claim 65, Hu teaches A password management system, 
comprising: 

'a identity integration system having a metaverse space for persisting 
integrated identity information regarding accounts associated with a user' (page 
3, paragraph 0034, and figure 1). 

'connector space for persisting information representing multiple data 
sources connectable to the identity integration system' (page 2 paragraph 0027 
and , and figure ). 
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'wherein the accounts have associated manageable passwords' (page 1, 
paragraph 0005 and figure 7a). 

'an interface to communicatively couple the identity integration system 
with the web application' (page 7, paragraph 0064). 

Hu fails to teach a web application for producing a list of the accounts from the 
identity integration system, for allowing selection of at least some of the accounts, for 
inputting a password, and for requesting the identity integration system to update 
passwords on the accounts based on the input password. 

Bush, however, teaches 

'a web application for producing a list of the accounts from the identity 
integration system for allowing selection of at least some of the accounts' (page 
2, paragraph 0024, and figure 1a). 

'for inputting a password' (page 2, paragraph 0024, and figures 1a-1b). 

'for requesting the identity integration system to update passwords on the 
accounts based on the input password' (page 3, paragraph 0024 in respect to fig 
1b). 

It would have been obvious to one of ordinary skill in the data processing art at 
the time of the present invention to combine the teachings of the cited references 
because the teachings of Bush would have provided Hu's system with displays 
associated with the logon of users (page 1 , paragraph 0004). 

With respect to claim 67, Hu fails to teach a webpage that displays accounts and 
a status of a password management operation for each account displayed. 
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Bush, however, teaches 'a webpage that displays accounts and a status of a 
password management operation for each account displayed' (page 3, paragraph 
026, and figures 1c and 3). 

It would have been obvious to one of ordinary skill in the data processing art at 
the time of the present invention to combine the teachings of the cited references 
because the teachings of Bush would have provided Hu's system with displays 
associated with the logon of users (page 1 , paragraph 0004). 

With respect to claim 80, this claim has essentially the same subject matter as 
claim 65 as set forth above. Therefore, claim 80 is rejected for the same reasons as set 
forth above. 

Claims 27 and 85 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over the combination of Hu/Bush as applied to claims 21, 47-49, 53, 55-57, 59, 61, 65, 
67, 80 above in view of Davis et al. ('Davis' hereinafter) (US 6,976,262 B1). 

With respect to claim 27, the combination of Hu/Bush fails to teach the interface 
is a WINDOWS MANAGEMENT INSTRUMENTATION interface. 

Davis, however, teaches 'the interface is a WINDOWS MANAGEMENT 
INSTRUMENTATION interface' as using a WBEM system (col. 4, lines 52-62). 

It would have been obvious to one of ordinary skill in the data processing art at 
the time of the present invention to combine the teachings of the cited references 
because the teaching of Davis would have provided the combination of Hu/Bush's 
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system with a standard for managing systems, networks, users, and applications by 
using Internet technology (col. 1 lines 40-50, Davis). 

With respect to claim 85, the combination of Hu/Bush fails to teach the identity 
integration system accomplishes a password update on at least one of an ACTIVE 
DIRECTORY data source, a SUN ONE server data source, a LOTUS NOTES server 
data source, a WINDOWS NT server data source, a NOVELL EDIRECTORY server 
data source, and a flat file data source. 

Davis, however, teaches 'the identity integration system accomplishes a 
password update on at least one of an ACTIVE DIRECTORY data source, a SUN 
ONE server data source, a LOTUS NOTES server data source, a WINDOWS NT 
server data source, a NOVELL EDIRECTORY server data source, and a flat file 
data source' as web server such as the Sun Web Server (col. 5 lines 25-27), Novell 
(col. 6 lines 11-16), and a database using a flat file technique (col. 7, lines 8-10) may be 
used. 

It would have been obvious to one of ordinary skill in the data processing art at 
the time of the present invention to combine the teachings of the cited references 
because the teaching of Davis would have provided the combination of Hu/Bush's 
system with tools and technology that software developers can use to manage the 
environment of a computer system (col. 1 lines 57-63, Davis). 



Conclusion 
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The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. 

US 6,859,878 B1 issued to Kerr et al. on 2/22/2005. The subject matter 
disclosed therein is pertinent to that of claims 1-85 (i.e. password management). 

US 6,157,953 issued to Chang et al. The subject matter disclosed therein is 
pertinent to that of claims 1-85 (i.e. user account services manger). 

US 2001/0014907 A1 filed by Brebner on 1/18/2001. The subject matter 
disclosed therein is pertinent to that of claim 27 (i.e. Windows Management 
Instrumentation). 

Contact Information 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Robert M. Timblin whose telephone number is 571-272- 
5627. The examiner can normally be reached on M-F 8:00-4:30. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Jean R. Homere can be reached on 571-272-3780. The fax phone number 
for the organization where this application or proceeding is assigned is 571-273-8300. 
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Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 

Robert M. Timblin 
Patent Examiner: AU 2167 
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